ci: build and publish the server container image to GHCR

[Azerothian]

Why

Upstream publishes wheels to PyPI and five crates to crates.io; nothing produces a container image. Deploying this fork therefore means a full release cargo build on a workstation (~10–15 min cold) before anything can be pushed to a registry.

This fork builds its own image instead.

What

.github/workflows/release-image.yml — builds the repository's root Dockerfile and pushes switchyard-server to ghcr.io/crunchymonkies/switchyard.

• Triggers on a *.*.* tag, plus workflow_dispatch with an optional tag_suffix for building an unreleased branch on demand.
• Builds and loads the image locally first, runs --dry-run against a minimal passthrough config, and only then pushes. An image whose binary cannot start or parse config is never published.
• linux/amd64 only: .cargo/config.toml compiles for x86-64-v3, and a cross-architecture Rust release build under QEMU costs hours for no target node.
• Tags come from docker/metadata-action, which also supplies org.opencontainers.image.source — that label is what links the GHCR package back to this repo, so no LABEL in the Dockerfile is needed.
• No Dockerfile change: it copies Cargo.toml, Cargo.lock, rust-toolchain.toml, .cargo, and crates, and every workspace member lives under crates/.

.github/workflows/publish.yml — a github.repository == 'NVIDIA-NeMo/Switchyard' guard on the two jobs that have no needs. Every other job chains off one of them and a skipped dependency skips its dependents, so two lines neutralise PyPI and crates.io publishing in this fork without touching on:, which keeps the file mergeable when upstream changes it.

Notes

• The image tag is a release date stamp, not the crate version; nothing here asserts the two match.
• cache-to: type=gha helps the base and apt layers and makes the push step nearly free, but any source change still busts the single cargo build layer. Real incremental caching would need cargo-chef in the Dockerfile — deliberately out of scope.
• The GHCR package starts private even from a public repo; it needs a one-time visibility flip after the first push.
• The smoke config was verified locally: switchyard-server --config … --dry-run prints server OK: smoke.